Secrets not detected in PLSQL package

SonarQube Cloud
,
1
  • Using Bitbucket Cloud pipeline
  • PLSQL
  • Exploring the SonarQube Cloud Free Trial

Have this example statement we use to connect to an LDAP that I’m using to test the secret scanning:

  l_bind := dbms_ldap.simple_bind_s(
      ld     => l_session,
      dn     => 'jnewman',--username
      passwd => 'z9b5M3bX3MERSTP'--dummy password
   );

The scan via the pipeline seems to be working, but is not detecting any secrets:

image
image1348×584 27.9 KB

The file being scanned is a .sql file, and I’ve included it in the list of file patterns:

image
image995×689 49.1 KB

Anything that I’m missing that would prevent the secret from being picked up by the scanner?

3

Hey there.

We’ve had a long-standing (unfortunately private) internal ticket for implementing a Credentials should not be hard-coded rule for PL/SQL.

Because the credentials in question are generic and not linked to a specific provider, our shiny new “secret detection” rules don’t flag these instances as issues. However, I agree that this is an important gap.

I’ve linked your post to the existing ticket to increase its visibility, and I’ll also bring this up with our product managers.